To mitigate the effort to maintain my personal server, I am considering to only expose ssh port to the outside and use its socks proxy to reach other services. is Portknocking enough to reduce surface of attack to the minimum?

@aksdb@feddit.de
link
fedilink
English
31Y

Sure? It certainly detracts bots that now don’t discover the SSH port anymore. Against a targeted attack it’s less useful, but that is a very hard problem in any case. If someone is out to get you specifically, it will be a tough battle.

@ShortN0te@lemmy.ml
link
fedilink
English
01Y

Bots do not matter. They try just common know exploits. If your root password is not root you are fine.

@SheeEttin@lemmy.world
link
fedilink
English
01Y

Root login should be disabled, and ideally remote user auth should be key only, not password. And you should have a passphrase on your key.

@ShortN0te@lemmy.ml
link
fedilink
English
-11Y

Should be

Why? Dont recite a blogpost to me explain it. Following blindly security practices you do not understqnd can be very dangerous.

Disableing the root login gains nothing in regarding security. If you have a secure key or a passwordthey attacker will not get in no matter what. And once a account is compromised it ia trivial to extract the sudo passwors with simple aliases.

Passwords can be as secure as keys. Yes be default a weak key is still more secure then a weak passwors. But if you have a strong password policy in place it does not matter. Most valid argument for keys is the ease of you

Having a passphrase on the key is for example for my usecase irrelevant. I run full disk encryption on every device. A passphrase on those keys would not gain me much security only more inconvenience.

486
link
fedilink
3
edit-2
1Y

Disableing the root login gains nothing in regarding security.

This is usually not the reason people recommend disabling root login. Since root is an anonymous account not tied to an actual person, in a corporate setting, you do not really know who used that account if you allow root login. If this is relevant for a personal home network is for you to decide. I would say there is not such a strong argument for it to be made in that setting.

@ShortN0te@lemmy.ml
link
fedilink
English
01Y

I absolutely agree with your. It can makes sence the disable it for access control, loging, auditing, etc. .

But when you look online or just in the comment section here lots of ppl actually recommend it as a security meassure against attackers. “Need to brute force the username as well”

@zaphod@lemmy.ca
link
fedilink
English
11Y

If you’re worried about bots just use a non-standard port and move on. I did that on my own VPS just to cut down on log chatter and I get absolutely zero ssh attack attempts after the change.

Create a post

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.

Rules:

  1. Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

  • 1 user online
  • 126 users / day
  • 421 users / week
  • 1.16K users / month
  • 3.85K users / 6 months
  • 1 subscriber
  • 3.68K Posts
  • 74.2K Comments
  • Modlog